Description
The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted (1) R_U_THERE or (2) R_U_THERE_ACK Dead Peer Detection (DPD) IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | strongswan | 4.2.14-1 | — |
| Debian 13 | strongswan | 4.2.14-1 | — |
| Debian 12 | strongswan | 4.2.14-1 | — |
| Debian 5.0 | openswan | 1:2.4.12+dfsg-1.3+lenny1 | DSA-1760-1 |
| Debian 5.0 | strongswan | 4.2.4-5+lenny1 | DSA-1759-1 |
| Debian 4.0 | openswan | 1:2.4.6+dfsg.2-1.1+etch1 | DSA-1760-1 |
| Debian 4.0 | strongswan | 2.8.0+dfsg-1+etch1 | DSA-1759-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | openswan +1 | 2.6.14-1.el5_3.2 | RHSA-2009:0402 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | strongswan | 5.3.5-1.1 | openSUSE-SU-2024:10579-1 |
Advisories 4
- RHSA-2009:0402 Red Hat Security Advisory: openswan security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1759-1 strongswan - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1760-1 openswan - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10579-1 strongswan-5.3.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- openswan-strongswan-dpd-dos(49523) vdb-entry
- 34494 third-party-advisory
- oval:org.mitre.oval:def:11171 vdb-entry signature
- 34472 third-party-advisory
- DSA-1759 vendor-advisory
- ADV-2009-0886 vdb-entry
- 1021949 vdb-entry
- 34546 third-party-advisory
- 20090330 CVE-2009-0790: ISAKMP DPD Remote Vulnerability with Openswan & Strongswan IPsec mailing-list
- 34483 third-party-advisory
- http://www.openswan.org/CVE-2009-0790/CVE-2009-0790.txt
- 1021950 vdb-entry
- http://download.strongswan.org/CHANGES4.txt
- SUSE-SR:2009:009 vendor-advisory
- RHSA-2009:0402 vendor-advisory
- DSA-1760 vendor-advisory
- 34296 vdb-entry